php2shell: the safest line of PHP is the one that never runs

On 21 October 2026, the PHP project released emergency patches for two critical security flaws that their discoverers have named “php2shell” (CVE-2026-109618 and CVE-2026-109619). They are rated 9.2 out of 10 (CVSS v4.0) and can be exploited remotely without logging in. In one variant that has already been demonstrated, a single request is enough, before a single line of WordPress, Joomla or Drupal code even runs.

Security researcher Kevin Beaumont described it as one of the biggest vulnerabilities in years. The UK's NCSC advises taking systems offline if they cannot be updated immediately.

What happened

• The bug sits in the PHP core itself, not in a plugin or theme. According to Wiz Research, every PHP version of the last ten years is affected by at least one of the two flaws, going back to PHP 5.4.
• Wiz has demonstrated unauthenticated remote code execution against current WordPress, Drupal and Joomla installations. In addition, server memory can be read out, which may contain passwords, tokens and API keys.
• The details leaked before the patch. Amazon registered an exploitation attempt as early as 17 October, four days before the official release.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are patched. PHP 8.1 and older are no longer officially supported by the PHP project. Only an upgrade or a backport from the hosting provider helps there.

The real problem: the website nobody looks after

Anyone who deals with SME websites knows the picture: the site was set up by an agency seven years ago. It runs on a cheap shared hosting package. The WordPress theme has not been touched since, and the question “Which PHP version are you running, actually?” is met with a shrug.

These are exactly the websites that now become a risk. Mostly their owners are not negligent, it is simply that nobody feels responsible. Security expert Hal Pomeranz pointed to countless installations that will never be patched.

An attack hits more than the website. Whoever can run code on the server can redirect visitors to phishing sites, distribute malware, harvest form data or send spam in the company's name. For an SME, that quickly means a warning in Google, suspended hosting and a data protection incident.

Does my website need PHP at all?

The vast majority of SME websites do not.

The website of a carpentry workshop, a physiotherapy practice or an accounting firm shows services, references, opening hours and a contact form. It does not have to calculate anything during a visit. Even so, every page request starts a PHP process, queries a database and assembles HTML from the result. That brings the whole attack surface with it: PHP itself, the CMS, dozens of plugins, the database and the admin login.

It is like having a business card freshly printed for every prospect and leaving the print shop unlocked around the clock to do so.

Of course there are cases where server-side code is needed: an online shop, a customer portal, complex booking logic. It then needs to be operated professionally and maintained continuously. For the majority of SME websites, though, PHP is a risk with nothing in return.

How Revivra solves the problem at its root

With Revivra we modernise exactly these websites. You enter the existing URL and answer a few questions about the design you want. A few minutes later there is a redesigned presence based on your existing content. With php2shell in mind, these points matter most:

1. Revivra generates static websites from plain HTML, CSS and JavaScript, built once. There is no PHP, no database and no plugins. No server code that could be exploited runs when a page is requested, so a flaw like php2shell does not affect a Revivra website.
2. The pages are served directly from Cloudflare's infrastructure (object storage and edge network). You do not have to manage a web server. There is no shared hosting server with mod_php or PHP-FPM, no cPanel and no admin login on your website that gets brute-force attacks around the clock. Static pages loaded from the edge are also fast, which visitors and Google both like.
3. Contact forms run through a separate service that we operate. There is therefore no kontakt.php next to your pages, as found on countless old websites.
4. We take care of updates. Revivra is managed hosting: you do not get a “Please update your PHP version” email from the host, you do not play plugin update roulette, and you do not pay agency hours for security patches.
5. Editing stays simple all the same. You adjust content in the Revivra editor, after which the website is rebuilt and published. You do not need code for that.
6. Agencies can use White Label. Anyone who looks after dozens of client websites on PHP has to touch every single one this week anyway. With Revivra, they can move them to a low-maintenance, static foundation under their own brand, instead of starting over with the next critical CVE.

What you should do now

Does your website run on PHP today, for example on WordPress, Joomla, Drupal, TYPO3 or a custom build?

1. Ask today. Have your host or agency confirm that PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 respectively (or a patched build from your distribution).
2. If PHP 8.1 or older is still running, that is an emergency, because there is no official support for it. Upgrade, or until then put the site behind a web application firewall or take it offline.
3. Check the protection rules. Cloudflare has rolled out WAF rules against known attack patterns, by its own account for all customers, including on the free plan. Many hosts have followed on the server side. Ask them.
4. After that, a strategic question is worth asking: does this have to work the same way next time?

Sources

• Wiz Research: “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet”
• Help Net Security: “PHP2Shell: Critical PHP vulnerabilities patched, update now!”
• Huntress: “Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities”